"SSO admin service failure" exception in vSphere 6.0.2

[sunilkumardm]

Hi,

We are using vSphere 6.0 Update 2 (6.0.2). We are seeing the below exception consistently when we call _userSessionService.getUserSession(). This happens when we invoke the function the first time as well.

However, this issue is NOT seen in vSphere 6.0. Could you please suggest any pointers to fix this?

[2016-06-08T17:06:36.891Z] [ERROR] http-bio-9090-exec-171       70007534 100144 200056 c.vmware.vsphere.client.usersession.impl.UserSessionServiceImpl   There was an issue while extracting the list of system domains com.vmware.vise.vim.security.sso.exception.SsoServiceException: SSO admin service failure

        at com.vmware.vise.vim.security.sso.SsoUtil.getAdminService(SsoUtil.java:256)

        at com.vmware.vsphere.client.usersession.impl.UserSessionServiceImpl.extractSystemDomains(UserSessionServiceImpl.java:176)

        at com.vmware.vsphere.client.usersession.impl.UserSessionServiceImpl.getUserSession(UserSessionServiceImpl.java:153)

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)

        at java.lang.reflect.Method.invoke(Unknown Source)

        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:319)

        at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.doInvoke(ServiceInvoker.java:56)

        at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.invoke(ServiceInvoker.java:60)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

        at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

        at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

        at org.eclipse.gemini.blueprint.service.importer.support.LocalBundleContextAdvice.invoke(LocalBundleContextAdvice.java:57)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

        at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

        at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)

        at com.sun.proxy.$Proxy624.getUserSession(Unknown Source)

        at com.mycompany.vsphere.ObjectStoreManager.getAllPods(ObjectStoreManager.java:91)

        at com.mycompany.vsphere.VSphereDataAdapter.processSimpleConstraintForHttpRequest(VSphereDataAdapter.java:1663)

        at com.mycompany.vsphere.VSphereDataAdapter.processConstraintForHttpRequest(VSphereDataAdapter.java:1574)

        at com.mycompany.vsphere.VSphereDataAdapter.processQueryForHttpRequest(VSphereDataAdapter.java:1560)

        at com.mycompany.vsphere.VSphereDataAdapter.getDataForHttpRequest(VSphereDataAdapter.java:1542)

        at com.mycompany.VSpherehtmlui.mvc.DataAccessController.getBCFEntity(DataAccessController.java:228)

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)

        at java.lang.reflect.Method.invoke(Unknown Source)

        at org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:219)

        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:132)

        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:100)

        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:604)

        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:565)

        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:80)

        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:923)

        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852)

        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882)

        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:778)

        at javax.servlet.http.HttpServlet.service(HttpServlet.java:735)

        at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)

        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)

        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)

        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)

        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)

        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)

        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)

        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)

        at org.eclipse.virgo.web.tomcat.support.ApplicationNameTrackingValve.invoke(ApplicationNameTrackingValve.java:33)

        at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)

        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)

        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)

        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1040)

        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:607)

        at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:315)

        at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)

        at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

        at java.lang.Thread.run(Unknown Source)

Caused by: java.util.concurrent.ExecutionException: java.lang.IllegalArgumentException: interface com.vmware.vim.binding.sso.admin.ServiceInstance is not visible from class loader

        at java.util.concurrent.FutureTask.report(Unknown Source)

        at java.util.concurrent.FutureTask.get(Unknown Source)

        at com.vmware.vise.util.concurrent.client.ClientMonitorImpl.authenticate(ClientMonitorImpl.java:89)

        at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.getClientMonitor(SsoAdminServiceImpl.java:134)

        at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.<init>(SsoAdminServiceImpl.java:110)

        at com.vmware.vise.vim.security.sso.SsoUtil.getAdminService(SsoUtil.java:252)

        ... 66 common frames omitted

Caused by: java.lang.IllegalArgumentException: interface com.vmware.vim.binding.sso.admin.ServiceInstance is not visible from class loader

        at java.lang.reflect.Proxy$ProxyClassFactory.apply(Unknown Source)

        at java.lang.reflect.Proxy$ProxyClassFactory.apply(Unknown Source)

        at java.lang.reflect.WeakCache$Factory.get(Unknown Source)

        at java.lang.reflect.WeakCache.get(Unknown Source)

        at java.lang.reflect.Proxy.getProxyClass0(Unknown Source)

        at java.lang.reflect.Proxy.newProxyInstance(Unknown Source)

        at com.vmware.vim.vmomi.client.common.impl.ManagedObjectFactoryImpl.createManagedObject(ManagedObjectFactoryImpl.java:88)

        at com.vmware.vim.vmomi.client.http.impl.HttpClient.createStub(HttpClient.java:76)

        at com.vmware.vise.vim.commons.vmomi.ClientWithSharedHttpConfig.createStub(ClientWithSharedHttpConfig.java:66)

        at com.vmware.vise.vim.security.sso.impl.SsoUtilInternal.getSsoAdminServiceContent(SsoUtilInternal.java:253)

        at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.processLogin(SsoAdminServiceImpl.java:143)

        at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.access$300(SsoAdminServiceImpl.java:57)

        at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl$SolutionUserAuthenticator.authenticate(SsoAdminServiceImpl.java:497)

        at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl$SolutionUserAuthenticator.authenticate(SsoAdminServiceImpl.java:481)

        at com.vmware.vise.util.concurrent.client.ClientMonitorImpl$1.call(ClientMonitorImpl.java:209)

        at com.vmware.vise.util.concurrent.client.ClientMonitorImpl$1.call(ClientMonitorImpl.java:206)

        at java.util.concurrent.FutureTask.run(Unknown Source)

        at com.vmware.vise.util.concurrent.client.ClientMonitorImpl.authenticate(ClientMonitorImpl.java:74)

        ... 69 common frames omitted

[CathyBr]

I also am having the same Problem, I use the userSessionService.getUserSession  to get the userName and samlTokenXml.  In the virgo log I see the same exception and stack.  The strange Thing is, sometimes it works, and sometimes it doesn't.

[_vladi_]

This problem is currently under investigation by the vSphere Web Client team.

A similar thread is: Exception thrown by SsoUtil: SSO admin service failure

Cheers,

Vladi

[vesuvius_prime]

Can you, please, give me the build number that you've installed? If this is a Linux appliance, the build numbers should be in file /etc/vmware/.buildInfo.

This is no longer a problem in the upcoming 6.5 release. We will fix it in all the 6.0.x releases, but if you don't want to wait for the official patch, we may provide a workaround which you could apply manually into your environment, if you wish. However, just to be safe, we will need to get your build number, so that we can provide a workaround for that particular build.

[CathyBr]

Here is the exception stack

It happened on :

vCenter Server with an embedded Platform Service     -> 6.0.0.18326

VMware Client Integration Plug-in 6.0.0                              ->6.0.0.3933

It might be interesting that we use the vSphere Web Client SDK V5.5 to build in our production, because the plug-in must run on a 5.5 vCenter as well.

[2016-06-08T11:19:19.612+02:00] [ERROR] data-service-pool-3427       70008412 100082 200076 c.vmware.vsphere.client.usersession.impl.UserSessionServiceImpl   There was an issue while extracting the list of system domains com.vmware.vise.vim.security.sso.exception.SsoServiceException: SSO admin service failure

at com.vmware.vise.vim.security.sso.SsoUtil.getAdminService(SsoUtil.java:256)

at com.vmware.vsphere.client.usersession.impl.UserSessionServiceImpl.extractSystemDomains(UserSessionServiceImpl.java:179)

at com.vmware.vsphere.client.usersession.impl.UserSessionServiceImpl.getUserSession(UserSessionServiceImpl.java:156)

at sun.reflect.GeneratedMethodAccessor521.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:606)

at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:319)

at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.doInvoke(ServiceInvoker.java:56)

at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.invoke(ServiceInvoker.java:60)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.eclipse.gemini.blueprint.service.importer.support.LocalBundleContextAdvice.invoke(LocalBundleContextAdvice.java:57)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)

at com.sun.proxy.$Proxy519.getUserSession(Unknown Source)

at com.fujitsu.primergy.acme.acme_provider.adapter.AcmeDataProviderImpl.getPropertyFromSvServices(AcmeDataProviderImpl.java:918)

at com.fujitsu.primergy.acme.acme_provider.adapter.AcmeDataProviderImpl.getProperty(AcmeDataProviderImpl.java:809)

at com.fujitsu.primergy.acme.acme_provider.adapter.AcmeDataProviderImpl.getPropertyValuesList(AcmeDataProviderImpl.java:752)

at com.fujitsu.primergy.acme.acme_provider.adapter.AcmeDataProviderImpl.createResultItem(AcmeDataProviderImpl.java:720)

at com.fujitsu.primergy.acme.acme_provider.adapter.AcmeDataProviderImpl.processSimpleConstraint(AcmeDataProviderImpl.java:507)

at com.fujitsu.primergy.acme.acme_provider.adapter.AcmeDataProviderImpl.processConstraint(AcmeDataProviderImpl.java:464)

at com.fujitsu.primergy.acme.acme_provider.adapter.AcmeDataProviderImpl.processQuerySpec(AcmeDataProviderImpl.java:412)

at com.fujitsu.primergy.acme.acme_provider.adapter.AcmeDataProviderImpl.getData(AcmeDataProviderImpl.java:386)

at com.vmware.vise.data.query.impl.DataAdapterUtil.getDataFromAdapter(DataAdapterUtil.java:135)

at com.vmware.vise.data.query.impl.DataAdapterUtil.getResultFromAdapter(DataAdapterUtil.java:96)

at com.vmware.vise.data.query.impl.DataAdapterUtil.access$000(DataAdapterUtil.java:33)

at com.vmware.vise.data.query.impl.DataAdapterUtil$1.run(DataAdapterUtil.java:73)

at com.vmware.vise.util.concurrent.ExecutorUtil$2.run(ExecutorUtil.java:187)

at com.vmware.vise.util.concurrent.ExecutorUtil$ThreadContextPropagatingRunnable.run(ExecutorUtil.java:584)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)

at java.lang.Thread.run(Thread.java:745)

Caused by: java.util.concurrent.ExecutionException: java.lang.IllegalArgumentException: interface com.vmware.vim.binding.sso.admin.ServiceInstance is not visible from class loader

at java.util.concurrent.FutureTask.report(FutureTask.java:122)

at java.util.concurrent.FutureTask.get(FutureTask.java:188)

at com.vmware.vise.util.concurrent.client.ClientMonitorImpl.authenticate(ClientMonitorImpl.java:89)

at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.getClientMonitor(SsoAdminServiceImpl.java:134)

at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.<init>(SsoAdminServiceImpl.java:110)

at com.vmware.vise.vim.security.sso.SsoUtil.getAdminService(SsoUtil.java:252)

... 36 common frames omitted

Caused by: java.lang.IllegalArgumentException: interface com.vmware.vim.binding.sso.admin.ServiceInstance is not visible from class loader

at java.lang.reflect.Proxy$ProxyClassFactory.apply(Proxy.java:616)

at java.lang.reflect.Proxy$ProxyClassFactory.apply(Proxy.java:592)

at java.lang.reflect.WeakCache$Factory.get(WeakCache.java:244)

at java.lang.reflect.WeakCache.get(WeakCache.java:141)

at java.lang.reflect.Proxy.getProxyClass0(Proxy.java:455)

at java.lang.reflect.Proxy.newProxyInstance(Proxy.java:738)

at com.vmware.vim.vmomi.client.common.impl.ManagedObjectFactoryImpl.createManagedObject(ManagedObjectFactoryImpl.java:88)

at com.vmware.vim.vmomi.client.http.impl.HttpClient.createStub(HttpClient.java:76)

at com.vmware.vise.vim.commons.vmomi.ClientWithSharedHttpConfig.createStub(ClientWithSharedHttpConfig.java:66)

at com.vmware.vise.vim.security.sso.impl.SsoUtilInternal.getSsoAdminServiceContent(SsoUtilInternal.java:252)

at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.processLogin(SsoAdminServiceImpl.java:143)

at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.access$300(SsoAdminServiceImpl.java:57)

at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl$SolutionUserAuthenticator.authenticate(SsoAdminServiceImpl.java:497)

at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl$SolutionUserAuthenticator.authenticate(SsoAdminServiceImpl.java:481)

at com.vmware.vise.util.concurrent.client.ClientMonitorImpl$1.call(ClientMonitorImpl.java:209)

at com.vmware.vise.util.concurrent.client.ClientMonitorImpl$1.call(ClientMonitorImpl.java:206)

at java.util.concurrent.FutureTask.run(FutureTask.java:262)

at com.vmware.vise.util.concurrent.client.ClientMonitorImpl.authenticate(ClientMonitorImpl.java:74)

... 39 common frames omitted

Cathy

[vesuvius_prime]

Thank you for the additional info. However, I will need the build number. Can you tell me what's printed in the 'About' info of the vSphere Web Client?

This is a class loading issue. Apparently, sometimes the thread's context class loader is different from what's expected. Depending on which class loader it is, the loading of class com.vmware.vim.binding.sso.admin.ServiceInstance may fail or succeed. More precisely, if it's the class loader of an OSGi bundle which has visibility to this class, i.e. if the bundle's MANIFEST.MF contains an import for package com.vmware.vim.binding.sso.admin, then the class loading will succeed. Otherwise, it won't.

Assuming that the thread's context class loader happens to be the bundle class loader of a bundle which you control (a bundle from your plug-in), the problem might go away by just adding the Import-Package clause into your MANIFEST.MF. However, this is not a good solution in principle because the class loader might be completely different, and also because this forces your bundle to deal with things that are not its concern.

I can compile and provide a fixed .class file, and then you can replace the current .class file in vim-services-X.X.X.jar with the new .class file. This should fix the problem, but, of course, you might be unwilling to do such things and I will understand. If you are willing, though, I will need your build number, so that I can create the correct .class file for that build.

Is your appliance Linux-based or Windows-based?

[sunilkumardm]

Thanks vesuvius_prime for your mail.

I would like to try the workaround until the official path comes out. The vSphere Web Client version is: Version 6.0.0 Build 3617395.

Regards,

Sunil

[sunilkumardm]

Forgot to mention that it is Linux-based appliance. Thanks!

[vesuvius_prime]

I attached an archive containing the fixed class file as well as some instructions. Please, let me know how it went. If you have further questions, I will do my best to answer them.

IMPORTANT: This fixed class is only applicable for vSphere Web Client 6.0 U2, build 3617395. If you need a fixed class for some other build, please, tell us your build number and we'll compile an appropriate class file for you.

[CathyBr]

We have

vSphere Web Client: Version 6.0.0 Build 3271482

Client-Integrations-Plug-In:  6.0.0 Build 3632585

Could you please include a patch for that?

Thanks

Cathy

[vesuvius_prime]

Sure, I'm attaching a patch for build 3271482. Please, let me know if you encounter any problems. In fact, please, let me know even if you don't encounter problems. I'll appreciate the feedback. 

[mikemayors]

Thanks! We hit this same exception in house and the patch you provided has resolved the issue.  Do you know when this will be made available to customers?

Mike

[mikemayors]

vesuvius_prime One more question, we have a customer who is hitting this same exception except they are running update 1b, build 3339083.  Will either of these patch files work with this build number?  Also is this something you would trust being installed in a production customer environment?  If not is there anything you can recommend to help us unblock them?  Our extension is unusable because we can never get a session from the user session service.  Thanks again for the updates on this, this is good news

[vesuvius_prime]

I will inquire about the release schedule for the next update/patch and will let you know.

I think that the modification to the class file is safe for use in production. It just explicitly sets a class loader for the duration of one operation type, nothing else. But it's still best to try the modification out on some non-production environment before promoting it to production. It's the safest approach.

Please, ask the customer to open the Web Client's 'About' box and to tell you the build number which is printed there.

[vesuvius_prime]

Well, the next Update for 6.0 is Update 3 which is scheduled for February 2017. Kind of far away. However, I was told that "If there is any higher attention required, we need to make sure that a hot-patch is required so that we can release earlier than 6.0 U3".

So, if this is something that cannot wait till February, please, let me know. I will inform the people around here and they might schedule a hot patch for some earlier date. I myself am not in control of releases, but I can at least pass the info and they will decide.

[mikemayors]

vesuvius_prime‌ thanks for the info! Since we already have several customers seeing this problem (and no workaround or way to resolve other than accidentally or rebuilding new vCenters) please ask if this can be provided as a hot patch. 

Our problem customers are running:

6.0.0, build=3339083

6.0.0, build=3339084

Can you provide a patched class for these builds like you did above?  Thanks again, this is a good end to the week :smileycool:

[vesuvius_prime]

Build 3339083 is a vpxwin, while build 3339084 is a vpxlin. These are not vSphere Web Client builds. However, I checked who consumes these builds and there are only two consumers for each build and each of these consumers uses vSphere Web Client build 3271482, so I think, yes, the fixed class that I attached in an earlier post can also be used for this customer as well. It would have been better if the customer had reported the actual vSphere Web Client builds, but I think we can be quite certain that the build is 3271482.

I told our CPD people about your request for a hot patch. I will let you know of any additional info they tell me.

[vesuvius_prime]

Got a reply from CPD:

"For us to raise the h-patch, could we, please, ask the customer to raise SRs with our customer support? Without the SRs, it may not be possible to get an h-patch."

So, is it okay by you to submit an SR?

[mikemayors]

Do you mean have the customer open a Support Request with VMware customer support? Do you have pointers on what the customer should say?

i.e. "I cannot manage a vSphere web client extension. I'm seeing these (SSO) errors in the logs and the vendor told us this is a vCenter issue and to raise it with VMware support" ?

I ask because I don't want VMware support telling the customer to contact the extension's vendor and then we go full circle.

Two questions:

1. If applying the patch in linked mode should it be installed on both vCenters?

2. My stack trace differs from what's in instructions.txt.  Instructions.txt has the following cause: Caused by: java.lang.IllegalArgumentException: interface com.vmware.vim.binding.sso.admin.ServiceInstance is not visible from class loader

My stacktrace has: Caused by: com.vmware.vim.binding.vmodl.RuntimeFault: Unable to dispatch request: Failed to create session

Is my issue different than the one this patch fixes?

Here's the full stacktrace (with my extension's stack omitted):

[2016-02-17T08:45:41.702-05:00] [ERROR] data-service-pool-283711     70033948 100252 200143 c.vmware.vsphere.client.usersession.impl.UserSessionServiceImpl   There was an issue while extracting the list of system domains com.vmware.vise.vim.security.sso.exception.SsoServiceException: SSO admin service failure

  at com.vmware.vise.vim.security.sso.SsoUtil.getAdminService(SsoUtil.java:256)

  at com.vmware.vsphere.client.usersession.impl.UserSessionServiceImpl.extractSystemDomains(UserSessionServiceImpl.java:179)

  at com.vmware.vsphere.client.usersession.impl.UserSessionServiceImpl.getUserSession(UserSessionServiceImpl.java:156)

  at sun.reflect.GeneratedMethodAccessor688.invoke(Unknown Source)

  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

  at java.lang.reflect.Method.invoke(Method.java:606)

  at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:319)

  at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.doInvoke(ServiceInvoker.java:56)

  at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.invoke(ServiceInvoker.java:60)

  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

  at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

  at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

  at org.eclipse.gemini.blueprint.service.importer.support.LocalBundleContextAdvice.invoke(LocalBundleContextAdvice.java:57)

  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

  at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

  at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

  at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)

  at com.sun.proxy.$Proxy587.getUserSession(Unknown Source)

  [ sensitive packages removed ]

  at sun.reflect.GeneratedMethodAccessor1042.invoke(Unknown Source)

  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

  at java.lang.reflect.Method.invoke(Method.java:606)

  at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:319)

  at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.doInvoke(ServiceInvoker.java:56)

  at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.invoke(ServiceInvoker.java:60)

  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

  at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

  at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

  at org.eclipse.gemini.blueprint.service.importer.support.LocalBundleContextAdvice.invoke(LocalBundleContextAdvice.java:57)

  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

  at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

  at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

  at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)

  at com.sun.proxy.$Proxy661.getInfo(Unknown Source)

  [ sensitive packages removed (my implementation of property provider adapter) ]

  at com.vmware.vise.data.query.impl.DataManager.getDataFromPropertyProvider(DataManager.java:1312)

  at com.vmware.vise.data.query.impl.DataManager.getResultFromPropertyProvider(DataManager.java:1283)

  at com.vmware.vise.data.query.impl.DataManager.access$000(DataManager.java:67)

  at com.vmware.vise.data.query.impl.DataManager$1.run(DataManager.java:858)

  at com.vmware.vise.util.concurrent.ExecutorUtil$2.run(ExecutorUtil.java:187)

  at com.vmware.vise.util.concurrent.ExecutorUtil$ThreadContextPropagatingRunnable.run(ExecutorUtil.java:584)

  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)

  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)

  at java.lang.Thread.run(Thread.java:745)

Caused by: java.util.concurrent.ExecutionException: com.vmware.vim.binding.vmodl.RuntimeFault: Unable to dispatch request: Failed to create session

  at java.util.concurrent.FutureTask.report(FutureTask.java:122)

  at java.util.concurrent.FutureTask.get(FutureTask.java:188)

  at com.vmware.vise.util.concurrent.client.ClientMonitorImpl.authenticate(ClientMonitorImpl.java:89)

  at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.getClientMonitor(SsoAdminServiceImpl.java:134)

  at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.<init>(SsoAdminServiceImpl.java:110)

  at com.vmware.vise.vim.security.sso.SsoUtil.getAdminService(SsoUtil.java:252)

  ... 68 common frames omitted

Caused by: com.vmware.vim.binding.vmodl.RuntimeFault: Unable to dispatch request: Failed to create session

  at sun.reflect.GeneratedConstructorAccessor461.newInstance(Unknown Source)

  at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)

  at java.lang.reflect.Constructor.newInstance(Constructor.java:526)

  at java.lang.Class.newInstance(Class.java:383)

  at com.vmware.vim.vmomi.core.types.impl.ComplexTypeImpl.newInstance(ComplexTypeImpl.java:173)

  at com.vmware.vim.vmomi.core.types.impl.DefaultDataObjectFactory.newDataObject(DefaultDataObjectFactory.java:26)

  at com.vmware.vim.vmomi.core.soap.impl.unmarshaller.ComplexStackContext.<init>(ComplexStackContext.java:31)

  at com.vmware.vim.vmomi.core.soap.impl.unmarshaller.UnmarshallerImpl$UnmarshallSoapFaultContext.parse(UnmarshallerImpl.java:141)

  at com.vmware.vim.vmomi.core.soap.impl.unmarshaller.UnmarshallerImpl$UnmarshallSoapFaultContext.unmarshall(UnmarshallerImpl.java:102)

  at com.vmware.vim.vmomi.core.soap.impl.unmarshaller.UnmarshallerImpl.unmarshalSoapFault(UnmarshallerImpl.java:89)

  at com.vmware.vim.vmomi.core.soap.impl.unmarshaller.UnmarshallerImpl.unmarshalSoapFault(UnmarshallerImpl.java:84)

  at com.vmware.vim.vmomi.client.common.impl.SoapFaultStackContext.setValue(SoapFaultStackContext.java:41)

  at com.vmware.vim.vmomi.client.common.impl.ResponseUnmarshaller.unmarshal(ResponseUnmarshaller.java:112)

  at com.vmware.vim.vmomi.client.common.impl.ResponseImpl.unmarshalResponse(ResponseImpl.java:273)

  at com.vmware.vim.vmomi.client.common.impl.ResponseImpl.setResponse(ResponseImpl.java:230)

  at com.vmware.vim.vmomi.client.http.impl.HttpExchangeBase.parseResponse(HttpExchangeBase.java:144)

  at com.vmware.vim.vmomi.client.http.impl.HttpExchange.run(HttpExchange.java:51)

  at com.vmware.vim.vmomi.client.http.impl.HttpProtocolBindingBase.executeRunnable(HttpProtocolBindingBase.java:186)

  at com.vmware.vim.vmomi.client.http.impl.HttpProtocolBindingImpl.send(HttpProtocolBindingImpl.java:115)

  at com.vmware.vim.vmomi.client.common.impl.MethodInvocationHandlerImpl$CallExecutor.sendCall(MethodInvocationHandlerImpl.java:581)

  at com.vmware.vim.vmomi.client.common.impl.MethodInvocationHandlerImpl$CallExecutor.executeCall(MethodInvocationHandlerImpl.java:562)

  at com.vmware.vim.vmomi.client.common.impl.MethodInvocationHandlerImpl.completeCall(MethodInvocationHandlerImpl.java:348)

  at com.vmware.vim.vmomi.client.common.impl.MethodInvocationHandlerImpl.invokeOperation(MethodInvocationHandlerImpl.java:308)

  at com.vmware.vim.vmomi.client.common.impl.MethodInvocationHandlerImpl.invoke(MethodInvocationHandlerImpl.java:182)

  at com.sun.proxy.$Proxy602.retrieveServiceContent(Unknown Source)

  at com.vmware.vise.vim.security.sso.impl.SsoUtilInternal.getSsoAdminServiceContent(SsoUtilInternal.java:253)

  at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.processLogin(SsoAdminServiceImpl.java:143)

  at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl.access$300(SsoAdminServiceImpl.java:57)

  at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl$SolutionUserAuthenticator.authenticate(SsoAdminServiceImpl.java:497)

  at com.vmware.vise.vim.security.sso.impl.SsoAdminServiceImpl$SolutionUserAuthenticator.authenticate(SsoAdminServiceImpl.java:481)

  at com.vmware.vise.util.concurrent.client.ClientMonitorImpl$1.call(ClientMonitorImpl.java:209)

  at com.vmware.vise.util.concurrent.client.ClientMonitorImpl$1.call(ClientMonitorImpl.java:206)

  at java.util.concurrent.FutureTask.run(FutureTask.java:262)

  at com.vmware.vise.util.concurrent.client.ClientMonitorImpl.authenticate(ClientMonitorImpl.java:74)

  ... 71 common frames omitted

[vesuvius_prime]

I asked for additional details regarding the SR.

As for your two questions, here are the answers:

1. If applying the patch in linked mode should it be installed on both vCenters?

Yes. Linked mode replicates certain data such as privileges between VCs, but it doesn't replicate code. Unfortunately, every single Web Client will have to be patched individually.

2. My stack trace differs from what's in instructions.txt. ...

Unfortunately, your problem is different. The error is reported by the SSO server. I checked their source (but mind you, I'm not at all familiar with it), and I can see the following there:

// too many authenticated sessions
throw new ServiceUnavailableException("Failed to create session");

It seems that you might be getting intermittent errors from the SSO server because there are too many authenticated sessions. I can only guess what's happening in real life, but perhaps the users create too many sessions but don't log out of them explicitly afterwards. And it takes a while for the sessions to expire by themselves. So, probably sometimes you (or your customer) hit the limit and you get the error.

It doesn't hurt for you to apply the class-loading patch that I provided, but it will not solve the "Failed to create session" problem.